Connecting SBOM and CVE: an Insightful Study of Software Vulnerabilities

Analyzing vulnerabilities in software supply chains is critical for mitigating security risks. The Software Bill of Materials (SBOM) provides transparency by listing all components and dependencies. Additional sources, such as the National Vulnerability Database (NVD), the Open Web Application Security Project (OWASP), and the Common Vulnerabilities and Exposures (CVE) system, enhance vulnerability tracking. However, relying on a single source leads to incomplete analyses, as vulnerabilities in dependencies may still pose threats even when the primary software appears secure. Therefore, we require a comprehensive process to provide information on dependency vulnerability and an understanding of general software vulnerabilities.To address the above-mentioned problems, we introduce SOMVE (SbOM and cVE), a process based on Machine Learning (ML) model to integrate SBOM and CVE. This integration provides comprehensive vulnerability information, which is not available by SBOM or CVE individually otherwise. As such SBOM provides 5 metrics and CVE contains 21 metrics. Therefore, we identify and extract the matching CVIDs that are common between both datasets. The Random Forest (RF) model used in SOMVE traces the vulnerabilities (using CVIDs) missed by focusing exclusively on the SBOM data. Specifically, SOMVE includes key details such as vulnerability scores, impacts, descriptions, and assessments. A rigorous experiment on SOMVE shows 97% accuracy in mapping the CVE IDs from both sources. Finally, SOMVE generates a consolidated JSON report with 11 metrics that highlight the importance of comprehensive vulnerability analysis to secure software supply chains.